DNS over TLS and HTTPS set up in one step

jarl encrypted-dns setup (and the Encrypted DNS page) finds or obtains a
certificate for the host name, checks that nothing else listens on the
DoT and DoH ports at the chosen addresses (offering a free DoH port), and
stages named's tls statement and listeners as one change, keeping port 53
where it was when there was no listen-on, plus the host name's records in
the private views (local to the view in a linked zone). Status shows what
to give Android, Linux, Firefox, Chrome and Windows clients. A tls
statement with missing files is refused (tls_file_missing), and a
certificate named uses can't be deleted. docs/encrypted-dns.md, e2e with
real DoT and DoH queries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -556,6 +556,11 @@ Needs `stats:read`. When statistics are disabled, every endpoint but
 curl -sf -H "$AUTH" "$API/stats/top?kind=nxdomain&since=7d&limit=10" | jq -r '.[] | "\(.count)\t\(.key)"'
 ```
 
+### Encrypted DNS
+
+See [encrypted-dns.md](encrypted-dns.md#api): `GET`, `POST` and `DELETE
+/encrypted-dns`, `POST /encrypted-dns/check`.
+
 ### Certificates
 
 Administrators only. See [certificates.md](certificates.md#api).